I have a healthy, 2/2 Ready Pod that has been running without restarts for over half an hour, on Kubernetes 1.27 through EKS.
When I try to run kubectl logs -n $MY_NS pod/$MY_POD -c $MY_CONTAINER on my Apple M1 Max with a kubectl version of 1.25, I get no logs. I am able to get logs for other Pods as I would expect.
When I exec into a Pod mounting the Node FS, I can see, in /var/log/pods/$MY_NS-$MY_POD/$MY_CONTAINER, logs (including rotations). I copied them with kubectl cp to my laptop, and they and the contents look roughly as I'd expect:
$ ls -la
total 16M
drwxr-xr-x 7 jrichards 224 Mar 12 15:45 ./
drwxr-xr-x 7 jrichards 224 Mar 12 15:45 ../
-rw-r--r-- 1 jrichards 0 Mar 12 15:45 0.log
-rw-r--r-- 1 jrichards 920K Mar 12 15:45 0.log.20240312-212825.gz
-rw-r--r-- 1 jrichards 922K Mar 12 15:45 0.log.20240312-212835.gz
-rw-r--r-- 1 jrichards 908K Mar 12 15:45 0.log.20240312-212845.gz
-rw-r--r-- 1 jrichards 13M Mar 12 15:45 0.log.20240312-212856
As you can probably tell from the filenames, the container in question was spamming a crazy number of log lines (the most recent gzip file was rotated after only ~10s, after recording >2k msg/s for ~10s, with an uncompressed file size of 76MiB).
Even so, this is very confusing to me. Why does kubectl logs not return the any logged output from this container? I tried the command multiple times.
I was able to find a kubernetes bugfix that's targeted for 1.29 relating to kubectl logs -f, but I'm not using -f.
I also found a 2015 kubernetes issue that mentions that '"kubectl logs" may give empty output' and 'I think we should advise that kubectl logs is just a "cache" of some of the logs for a pod'. Is this still true?
I have read the kuberenetes logging guide as well as the kubectl logs man page and found nothing that mentions any limitations on kubectl logs.
My questions:
- Where can I find details on the limitations of
kubectl logs? - Where can I find details of how Kubernetes handles log rotation?
- How I should expect files to be formatted and used in
/var/log/containers/$MY_NS-$MY_POD/$MY_CONTAINER?